What breaks when access certification is not scaled to match enterprise identity growth?

Why This Matters for Security Teams

access certification only works when the review loop is faster than identity growth. As the workforce, contractors, service accounts, and application integrations expand, manual review campaigns quickly become a bottleneck. Permissions then outlive their business need, reviewers approve stale entitlements by default, and risk accumulates between campaigns. That is especially dangerous for NHI-heavy estates, where credentials often proliferate faster than owners can track them.

NHI Mgmt Group notes that NHIs outnumber human identities by 25x to 50x in modern enterprises in the Ultimate Guide to NHIs, which helps explain why traditional certification programmes miss the mark once scale increases. OWASP also treats identity review gaps as a core control problem in the OWASP Non-Human Identity Top 10.

In practice, many security teams discover excessive access only after a review campaign has already lagged behind the pace of onboarding, system changes, and role churn.

How It Breaks in Practice

When certification is not scaled to match identity growth, the failure is rarely one dramatic event. It is a gradual loss of signal quality. Reviewers are asked to validate too many entitlements, across too many systems, with too little context. That forces people to rely on names, titles, or stale ownership records instead of actual usage and business need. The result is predictable: access gets rubber-stamped, deadlines slip, and exceptions become permanent.

For non-human identities, the issue is sharper because service accounts, API keys, and machine credentials often have no human owner that can credibly attest to current necessity. NHI Mgmt Group’s Top 10 NHI Issues highlights how excessive privileges and poor visibility compound each other. If certification does not ingest accurate inventory, last-used telemetry, and clear system ownership, it becomes a compliance exercise rather than a risk control.

• Scope certification to the identities and entitlements that changed since the last cycle, not the entire estate every time.
• Use usage evidence, not just manager approval, for privileged and technical accounts.
• Automate routing to the right owner so reviews do not stall in inboxes.
• Shorten cadences for high-risk systems and long-lived shared accounts.

Security teams should also align certification with control expectations in NIST SP 800-53 Rev 5 Security and Privacy Controls, where access reviews support continuous authorization and least privilege. These controls tend to break down when identity records are incomplete, because reviewers cannot reliably tell which entitlements are still legitimate.

Common Variations and Edge Cases

Tighter certification usually increases operational overhead, so organisations must balance control depth against reviewer fatigue and cycle duration. That tradeoff becomes most visible in enterprises with seasonal workforce spikes, outsourced operations, or large numbers of application-to-application accounts. Best practice is evolving, but current guidance suggests that high-risk access should be reviewed more frequently than low-risk access, and that low-value entitlements should be removed automatically where possible.

There is also no universal standard for how much of the process should be human versus automated. In mature programmes, automated pre-filtering narrows the review set to anomalous, privileged, or recently changed access, while humans handle exceptions and business context. That approach fits the direction of the Ultimate Guide to NHIs — Key Challenges and Risks, which emphasizes visibility and lifecycle discipline, and the review model described by OWASP. Where organisations still rely on quarterly, full-population reviews for every identity type, certification often loses relevance before the campaign even closes.

In the hardest environments, cloud sprawl, delegated admin, and ephemeral workloads make static ownership maps obsolete almost immediately after publication.

Related resources from NHI Mgmt Group

• What breaks when identity data and access decisions are not kept current across internal and external ecosystems?
• What breaks when organisations expand cloud access faster than they improve identity controls?
• What breaks when identity certification is separated from access change events?
• What breaks when identity governance cannot distinguish direct access from inherited access in enterprise directories?